Threats tagged 'ghsa-695c-x5gc-94gj'

Apache Camel's camel-coap component versions 4.14.0 through 4.14.5 and 4.18.0 before 4.18.1 are vulnerable to header injection. This occurs because CoAP request URI query parameters are mapped directly into Camel message headers without filtering. An unauthenticated attacker can exploit this to inject arbitrary internal headers, potentially leading to remote code execution when the exchange is forwarded to a header-sensitive downstream producer such as camel-exec. The vulnerability is fixed in versions 4.14.6, 4.18.1, and 4.19.0.